Piracy did not go away — it moved, and it got closer to the world's busiest waters. In 2025 the IMB recorded 137 piracy and armed-robbery incidents against ships, up from 116 the year before, and for the first time in years the single worst location was not off Somalia or in the Niger Delta but in the Singapore Strait, which alone accounted for 80 incidents, roughly 58% of the global total. The Gulf of Guinea, though quieter by count, remained by far the most violent theatre, responsible for the overwhelming majority of the world's crew kidnappings — 23 seafarers taken in just a handful of attacks. And the guidance the industry relies on changed too: in March 2025 the major shipping associations replaced the old patchwork of regional Best Management Practices with a single consolidated framework. For a ship master or company security officer, this means the security picture is both more dynamic and more demanding than it was even two years ago. Awareness alone is no longer enough; what is required is a layered, intelligence-led programme spanning voyage planning, vessel hardening, crew drills, reporting, and post-incident care. This guide covers the current threat map, the consolidated BMP framework, the ISPS security roles, ship protection and citadel measures, armed guards, the reporting chain, and building genuine security awareness across the crew.
Crew & training · maritime security
Maritime Security Awareness: Piracy, Armed Robbery & Anti-Terrorism
A guide for masters and CSOs — the 2025–26 threat map, the consolidated BMP Maritime Security framework, ISPS security roles, vessel hardening and citadel procedures, armed guards, the reporting chain, and crew security awareness.
Singapore Strait
80 incidents in 2025 — 58% of the global total; mostly opportunistic, rising weapon use
Gulf of Guinea
Most violent region; the large majority of global crew kidnappings — 23 taken in 2025
NW Indian Ocean
Somali piracy contained by naval presence, but residual risk if Red Sea tensions escalate
The Current Threat Map
Security planning starts with knowing where the danger actually is, and the geography has shifted. The three primary theatres each demand a different posture.
SE Asia
Singapore Strait and regional waters
The world's busiest shipping lane recorded the highest incident count in 2025 — around 80 attacks, more than half the global total. Most are low-level, opportunistic boardings for ship stores and valuables, but the carriage of weapons rose sharply, with far more gun sightings than the year before. Narrow, congested waters at slow speed create the opportunity; Indonesian marine police arrests of two gangs in mid-2025 cut the second-half figures.
W Africa
Gulf of Guinea
Lower in count than Southeast Asia but disproportionately violent, and the global epicentre of kidnap-for-ransom. Niger Delta-based networks operate far offshore — 50 to 200 nautical miles — with operational sophistication and a willingness to use violence. In 2025 the region accounted for the great majority of the world's crew kidnappings. Tankers and cargo vessels off Nigeria, Cameroon, and the Ivory Coast are the primary targets.
Indian Ocean
Somali Basin and Gulf of Aden
Somali piracy remains contained by sustained multinational naval presence, but it is contained, not eradicated — the capability persists ashore and residual incidents continue in the Northwest Indian Ocean. The compounding risk is regional: escalation of Red Sea tensions could stretch naval assets and reopen the window Somali networks once exploited.
Other
Emerging and secondary risks
The wider security environment now includes war-risk zones such as the Black Sea, with sea mines, drone attacks, and GPS jamming, and Red Sea threats to shipping. Anti-terrorism awareness — the original driver of the ISPS Code after the September 11 attacks and the tanker Limburg bombing — remains part of the picture, especially near unstable coastlines.
The strategic takeaway is that no single measure fits all three theatres. A Singapore Strait transit is about deterring a quick opportunistic boarding at the stern; a Gulf of Guinea passage is about surviving a determined, violent, offshore attack aimed at taking hostages. The security assessment must be route-specific and current, because the threat, as 2025 showed, moves.
The Consolidated BMP Framework
The most important recent change is structural. In March 2025 the major shipping associations — BIMCO, ICS, IMCA, INTERCARGO, INTERTANKO, and OCIMF — published Best Management Practices for Maritime Security, known as BMP MS, which consolidated and replaced the earlier separate regional documents such as BMP5 and the West Africa guidance.
1
One integrated framework
Rather than a separate booklet per region, BMP MS provides a single approach to threat and risk assessment, protective measures, and reporting that adapts to any theatre, covering every phase from voyage planning through post-incident response.
2
Threat and risk assessment
A structured, route-specific assessment before transit, using current intelligence to determine the measures the passage actually requires rather than applying a generic template.
3
Registration and reporting
Pre-transit registration with the relevant reporting centres and adherence to their protocols, so naval and coordinating authorities know the vessel is transiting and can respond.
4
Ship protection measures
Physical and procedural hardening scaled to the assessed risk, alongside vigilant watchkeeping and, where justified, speed and manoeuvring plans to defeat a boarding.
5
Drills and readiness
Regular scenario-based training — at least quarterly — so the crew's response is practised, not improvised, and citadel and lockdown procedures work under real pressure.
BMP MS sits alongside, not instead of, the ISPS Code. ISPS provides the mandatory legal architecture of security plans and officers; BMP MS provides the practical, current, threat-specific guidance for actually transiting a dangerous area. A well-run vessel uses both — the plan for compliance, the practice for survival.
Security drills, records, and readiness
Turn Your Security Plan Into Practised Readiness
BMP MS calls for quarterly scenario-based drills, route-specific risk assessments, and records that prove them. Marine Inspection schedules and logs security drills, holds the ship security assessment and plan, tracks crew security familiarisation, and keeps timestamped evidence ready for PSC and ISPS audits — so readiness is demonstrable, not assumed.
The ISPS Security Roles
Security has an accountable chain of command defined by the ISPS Code under SOLAS Chapter XI-2, and every master should know exactly who does what. The roles are the human backbone of any security response.
CSO — Company Security Officer
Shore-based, and often responsible for several vessels. Ensures the ship security assessment is conducted, the ship security plan is developed and maintained, and provides strategic security guidance to the fleet.
SSO — Ship Security Officer
A crew member aboard the vessel, accountable to the master and CSO. Implements the ship security plan, maintains the security level, conducts drills, promotes vigilance, and reports deficiencies and incidents.
PFSO — Port Facility Security Officer
Responsible for the Port Facility Security Plan and for liaising with SSOs and CSOs at the ship-port interface, where a Declaration of Security formalises shared responsibilities.
The three security levels
Level 1 is normal, with minimum measures permanently in effect; Level 2 is heightened; Level 3 is exceptional, for a probable or imminent threat. Levels are set by the flag or port state, and the SSP defines the actions each triggers.
SSAS — Ship Security Alert System
A covert alarm that sounds not on the ship but ashore, silently alerting the flag state and CSO to a security threat. Its transmission path and recipients must be documented in the ship security plan.
The distinction that catches people out is that the SSO must be a serving crew member, while a single CSO can cover many ships. In a piracy transit, this chain matters: the SSO runs the response on board, the CSO coordinates ashore, and the SSAS is the tripwire that brings in outside help without alerting the attackers.
Hardening the Ship
Physical and procedural measures are the practical core of piracy defence, scaled to the assessed threat. The goal is layered: make boarding difficult, delay any boarders reaching the crew, and buy time for naval response.
Watchkeeping and lookout
Enhanced vigilance, extra lookouts, and radar watch to detect an approach early. Detection at distance is the single greatest advantage — most measures depend on seeing the threat before it closes.
Physical barriers
Razor wire along vulnerable rails, water spray and hoses, secured and locked access points, and denial of the tools and ladders a boarder needs. The aim is to make the freeboard uninviting.
Speed and manoeuvre
Maintaining maximum safe speed and executing evasive helm manoeuvres generates wake and instability that make it far harder for a small craft to come alongside and board.
Access control and lockdown
Restricting entry points, controlling access to the accommodation and bridge, and a practised lockdown that slows any boarders who do get aboard from reaching the crew.
The citadel
A hardened, pre-designated safe room where the crew can retreat and hold out. It must sustain the crew for an extended period, protect communications, and let them maintain contact with shore authorities while denying attackers control of the ship.
Lighting and surveillance
Illuminating the vessel's sides and approaches at night, and using CCTV and monitoring to extend the watch, removing the darkness a stealthy boarding relies on.
The citadel deserves emphasis because it is the last line and the one that most often preserves crew safety. A citadel is only effective if it is genuinely secure, adequately stocked, communications-capable, and — critically — if the crew can reach it fast under a practised, drilled procedure. All measures must be balanced against SOLAS safety requirements: a security measure that creates a fire or escape hazard is not a solution.
Armed Guards and Naval Support
For the highest-risk transits, physical hardening may be supplemented by armed protection, but this is a decision surrounded by legal and practical complexity. The choice is never automatic.
When it is considered
Privately Contracted Armed Security Personnel are typically weighed for transits of the highest-risk zones such as the Somali Basin or Gulf of Guinea, particularly for slow, low-freeboard, or high-value vessels most vulnerable to boarding.
Legal complexity
The carriage and use of weapons is governed by flag-state authorisation, port and coastal-state law, and rules for the use of force. Some regions restrict or prohibit armed teams, and a floating armoury and transfer logistics add further legal layers.
Coordinated with the SSO
Armed teams do not replace the ship's own measures or the SSO's authority; they are integrated into the security plan, and the master retains overall command of the vessel throughout.
Naval and coordinating support
Multinational forces and coordination centres provide escort, monitoring, and response in key areas. Registering a transit and following pre-transit protocols is what makes that support reachable when it is needed.
The realistic view is that armed guards are one tool for one part of the problem, not a substitute for the whole programme. A vessel that has hardened properly, drilled its citadel, registered its transit, and maintained vigilant watch has done most of the work that keeps its crew safe — with or without a security team aboard.
The Reporting Chain
Reporting is not paperwork after the fact; it is what summons help during an incident and what protects the next ship after it. The chain must be known and rehearsed before it is needed.
1
Register before transit. Notify the relevant regional reporting or coordination centre before entering a high-risk area, following its pre-transit protocols so authorities expect the vessel.
2
Report suspicious activity immediately. Exact coordinates of any suspicious approach or craft, reported at once, let authorities warn other shipping and position a response.
3
Activate the SSAS in an attack. The covert alert brings in the flag state and CSO without alerting the attackers, in parallel with any distress communication.
4
Report the incident formally. To the IMB Piracy Reporting Centre and relevant authorities afterwards, building the shared intelligence picture that many incidents currently lack because they go unreported.
Under-reporting is a genuine problem, especially in the Gulf of Guinea, where many incidents never reach official statistics — which distorts the risk picture every other operator relies on. Reporting fully is both a duty and a contribution to the collective safety of the fleet.
Building Real Security Awareness
Equipment and plans achieve nothing without a crew that is genuinely alert and trained. Security awareness is the human layer that ties the whole programme together, and the ISPS Code requires it.
Security familiarisation
Every crew member receives security familiarisation within the first week of joining, covering security duties, restricted areas, SSAS awareness, and reporting procedures — the baseline the ISPS Code demands.
Designated-duty training
Seafarers with specific security duties hold the corresponding STCW proficiency, and the SSO holds ship security officer training covering threat recognition, plan implementation, and equipment.
Scenario-based drills
Regular, at least quarterly, drills rehearsing approach, boarding, lockdown, and citadel retreat, so the response is muscle memory rather than a scramble under fear.
A culture of vigilance
The SSO's job includes promoting a culture of security awareness — where reporting a suspicious craft or an unlocked door is routine, not exceptional. Vigilance is a habit, not an event.
Hostage and hijack conduct
Training on remaining calm during a hijack or hostage situation, using controlled breathing and composure, because crew behaviour materially affects survival and outcome.
Post-incident welfare
After any incident, crew welfare, evidence preservation, and regulatory reporting all matter. Kidnapping and attack leave psychological trauma that must be addressed, not ignored.
The through-line of modern maritime security is that it is a continuous programme, not an annual certificate. The threat map shifts, the guidance consolidates, the drills must stay current, and the records must prove all of it to a port state inspector or a vetting auditor. A master and CSO who treat security as living practice — assessed per route, hardened per risk, drilled per quarter, reported in full, and documented throughout — give their crew the best protection available. That is a demanding standard to maintain by hand, and it is fundamentally a matter of scheduling, records, and evidence.
Security as living practice, fully documented
Keep Security Assessments, Drills, and Records Ready
Hold the ship security assessment and plan, schedule and log quarterly security drills, track crew security familiarisation and SSO training, record every incident and its follow-up, and produce timestamped evidence the moment a PSC or ISPS audit asks. Marine Inspection turns maritime security from scattered paperwork into a demonstrable, always-current programme.
Frequently Asked Questions
Where are the main piracy hotspots now?
In 2025 the Singapore Strait recorded the most incidents — around 80, over half the global total — though mostly low-level and opportunistic. The Gulf of Guinea remained the most violent region and the source of the great majority of crew kidnappings. Somali piracy in the Northwest Indian Ocean is contained by naval presence but not eradicated, with residual risk if regional tensions escalate.
What is BMP Maritime Security?
Best Management Practices for Maritime Security, or BMP MS, is the consolidated guidance published in March 2025 by BIMCO, ICS, IMCA, INTERCARGO, INTERTANKO and OCIMF. It replaced the earlier separate regional documents such as BMP5 and the West Africa guidance with a single integrated framework covering threat and risk assessment, protective measures, reporting, and every phase from voyage planning to post-incident response.
What is the difference between the CSO and the SSO?
The Company Security Officer is shore-based and may be responsible for several vessels, ensuring the ship security assessment and plan are in place and providing strategic guidance. The Ship Security Officer must be a serving crew member aboard the vessel, implementing the plan, maintaining the security level, running drills, and reporting incidents to the master and CSO.
What is a citadel on a ship?
A citadel is a hardened, pre-designated safe room where the crew can retreat during a piracy attack. To be effective it must be genuinely secure, stocked to sustain the crew for an extended period, capable of maintaining communications with shore authorities, and reachable quickly under a practised, drilled procedure — while denying attackers control of the ship, and without compromising SOLAS safety requirements.
Are armed guards allowed on merchant ships?
Privately Contracted Armed Security Personnel may be used for the highest-risk transits, but their carriage and use of force is governed by flag-state authorisation and port and coastal-state law, and some regions restrict or prohibit them. Armed teams are integrated into the ship security plan and coordinated with the SSO; the master retains overall command of the vessel throughout.
How should a piracy incident be reported?
Register with the relevant regional reporting or coordination centre before entering a high-risk area, report any suspicious activity immediately with exact coordinates, activate the covert Ship Security Alert System during an attack to alert the flag state and CSO, and report the incident formally afterwards, including to the IMB Piracy Reporting Centre, to build the shared intelligence picture.
What security training do crew need?
Under the ISPS Code every crew member must receive security familiarisation within the first week of joining, covering security duties, restricted areas, SSAS awareness and reporting. Seafarers with designated security duties hold the corresponding STCW proficiency, the SSO holds ship security officer training, and the whole crew participates in regular scenario-based drills, recommended at least quarterly.
